URL:

https://verify-meta-check.t3.storage.dev/Verify-me-to-continue-ID-J-26016.html

Full analysis: https://app.any.run/tasks/c9be77a0-b135-4dfc-ac3c-67832276bf93
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 22, 2026, 23:36:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
Indicators:
MD5:

2506126E291B98A361F71664F28442B0

SHA1:

C269CCAF92D14262989C786E01487F1665B8DE8D

SHA256:

A6439CB65038FA7CD3C0FF94749E7212EC5F5555F6AACFD98A5EF96E081292C9

SSDEEP:

3:N80Mt9rGEMLWRKDkrHsKIf0RwqqTLDIJn:2QEMZDQMKzyqqwn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • PowerShell executes remote file download (POWERSHELL)

      • powershell.exe (PID: 9120)

    • Executing a file with an untrusted certificate

      • D_Droid.exe (PID: 8972)
      • D_Droid.exe (PID: 7256)

  • SUSPICIOUS

    • Possibly malicious use of IEX has been detected

      • powershell.exe (PID: 3224)

    • Starts POWERSHELL.EXE for commands execution

      • powershell.exe (PID: 3224)

    • Found IP address in command line

      • powershell.exe (PID: 9120)

    • Application launched itself

      • powershell.exe (PID: 3224)

    • Connects to unusual port

      • powershell.exe (PID: 3224)
      • powershell.exe (PID: 9120)

    • Starts a new process with hidden mode (POWERSHELL)

      • powershell.exe (PID: 9120)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 5716)
      • powershell.exe (PID: 9120)
      • D_Droid.exe (PID: 8972)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 5716)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 5716)
      • D_Droid.exe (PID: 8972)

    • Executable content was dropped or overwritten

      • D_Droid.exe (PID: 8972)
      • D_Droid.exe (PID: 7256)

    • Starts itself from another location

      • D_Droid.exe (PID: 8972)

  • INFO

    • Checks supported languages

      • identity_helper.exe (PID: 6296)
      • msiexec.exe (PID: 5716)
      • D_Droid.exe (PID: 8972)
      • D_Droid.exe (PID: 7256)
      • MicroPro.exe (PID: 5204)

    • Application launched itself

      • msedge.exe (PID: 6200)

    • Reads Environment values

      • identity_helper.exe (PID: 6296)

    • Drops script file

      • msedge.exe (PID: 8528)
      • powershell.exe (PID: 3224)
      • powershell.exe (PID: 9120)
      • powershell.exe (PID: 7560)

    • Reads the computer name

      • identity_helper.exe (PID: 6296)
      • msiexec.exe (PID: 5716)
      • D_Droid.exe (PID: 8972)
      • D_Droid.exe (PID: 7256)
      • MicroPro.exe (PID: 5204)

    • Manual execution by a user

      • powershell.exe (PID: 3224)

    • Checks current location (POWERSHELL)

      • powershell.exe (PID: 3224)
      • powershell.exe (PID: 7560)

    • Disables trace logs

      • powershell.exe (PID: 3224)
      • powershell.exe (PID: 9120)

    • Checks proxy server information

      • powershell.exe (PID: 3224)
      • powershell.exe (PID: 9120)

    • Create files in a temporary directory

      • powershell.exe (PID: 9120)
      • msiexec.exe (PID: 5716)
      • D_Droid.exe (PID: 7256)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 9120)

    • Gets a random number, or selects objects randomly from a collection (POWERSHELL)

      • powershell.exe (PID: 9120)

    • The sample compiled with english language support

      • msiexec.exe (PID: 5716)
      • powershell.exe (PID: 9120)
      • D_Droid.exe (PID: 8972)
      • D_Droid.exe (PID: 7256)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 5716)

    • Creates files in the program directory

      • D_Droid.exe (PID: 8972)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 5716)

    • The sample compiled with czech language support

      • powershell.exe (PID: 9120)
      • msiexec.exe (PID: 5716)
      • D_Droid.exe (PID: 8972)

    • Creates files or folders in the user directory

      • D_Droid.exe (PID: 7256)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
183
Monitored processes
29
Malicious processes
2
Suspicious processes
3

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs powershell.exe conhost.exe no specs powershell.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msiexec.exe no specs msiexec.exe d_droid.exe d_droid.exe powershell.exe no specs micropro.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1316"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6956,i,5664132572078437769,13006570512674935615,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=1516 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1340"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6944,i,5664132572078437769,13006570512674935615,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=1512 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1872"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3620,i,5664132572078437769,13006570512674935615,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2348"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --disable-quic --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=5420,i,5664132572078437769,13006570512674935615,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2376"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=6008,i,5664132572078437769,13006570512674935615,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3168\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3224"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
5204"C:\WINDOWS\system32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\s1903177891.msi" /qn /norestart C:\Windows\System32\msiexec.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
5204C:\Users\admin\AppData\Local\Temp\MicroPro.exeC:\Users\admin\AppData\Local\Temp\MicroPro.exe—D_Droid.exe
User:
admin
Company:
John Paul Chacha's Lab
Integrity Level:
MEDIUM
Description:
Configuration Utility for Chasys Draw IES
Version:
5, 34, 1, 0
Modules
Images
c:\windows\syswow64\wmp.dll
c:\users\admin\appdata\local\temp\micropro.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
5464"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=6168,i,5664132572078437769,13006570512674935615,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
3221226029
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\identity_helper.exe
c:\windows\system32\ntdll.dll
Total events
18 413
Read events
18 322
Write events
82
Delete events
9

Modification events

(PID) Process:(5716) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Config.Msi\
Value:
(PID) Process:(5716) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\1bbe9b.rbs
Value:
31230926
(PID) Process:(5716) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\1bbe9b.rbsLow
Value:
269633904
(PID) Process:(5716) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Users\admin\AppData\Roaming\Microsoft\Installer\
Value:
(PID) Process:(5716) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\C45C29957E1F73E5EA336F7F078300A2
Operation:writeName:D237314E5057D8C40873CC88BF051AB1
Value:
C:\Users\admin\AppData\Local\Temp\Layperson\Cieg.keac
(PID) Process:(5716) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\DA408AC3082012D578FECD5921F85DD4
Operation:writeName:D237314E5057D8C40873CC88BF051AB1
Value:
C:\Users\admin\AppData\Local\Temp\Layperson\Croort.jga
(PID) Process:(5716) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\2DBCD8B3E73D86C57AF298FBACC180B3
Operation:writeName:D237314E5057D8C40873CC88BF051AB1
Value:
C:\Users\admin\AppData\Local\Temp\Layperson\D_Droid.exe
(PID) Process:(5716) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\B9D58E7E45B4A8250ACEC88D2A66D820
Operation:writeName:D237314E5057D8C40873CC88BF051AB1
Value:
C:\Users\admin\AppData\Local\Temp\Layperson\mfc110u.dll
(PID) Process:(5716) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\B888A09DBD910F0548ED005C33A0BCD0
Operation:writeName:D237314E5057D8C40873CC88BF051AB1
Value:
C:\Users\admin\AppData\Local\Temp\Layperson\MSVCP110.dll
(PID) Process:(5716) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\2F58EAD310D8F9E589E499C508BFFE4D
Operation:writeName:D237314E5057D8C40873CC88BF051AB1
Value:
C:\Users\admin\AppData\Local\Temp\Layperson\MSVCR110.dll
Executable files
14
Suspicious files
45
Text files
235
Unknown types
0

Dropped files

PID
Process
Filename
Type
6200msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old~RF1b434f.TMP —
MD5:—
SHA256:—
6200msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old —
MD5:—
SHA256:—
6200msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF1b435e.TMP —
MD5:—
SHA256:—
6200msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6200msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF1b436e.TMP —
MD5:—
SHA256:—
6200msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF1b436e.TMP —
MD5:—
SHA256:—
6200msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF1b436e.TMP —
MD5:—
SHA256:—
6200msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
6200msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
6200msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
95
TCP/UDP connections
51
DNS requests
55
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5804
msedge.exe
GET
304
150.171.28.11:443
https://edge.microsoft.com/abusiveadblocking/api/v1/blocklist
unknown
—
—
whitelisted
5804
msedge.exe
GET
200
150.171.22.17:443
https://config.edge.skype.com/config/v1/Edge/133.0.3065.92?clientId=4489578223053569932&agents=Edge%2CEdgeConfig%2CEdgeServices%2CEdgeFirstRun%2CEdgeFirstRunConfig&osname=win&client=edge&channel=stable&scpfre=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=66&mngd=0&installdate=1661339457&edu=0&soobedate=1504771245&bphint=2&fg=1&lbfgdate=1766135237&lafgdate=0
unknown
text
4.66 Kb
whitelisted
5804
msedge.exe
GET
200
150.171.27.11:443
https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19045&devicefamily=desktop&installdate=1661339457&clientversion=133.0.3065.92&experimentationmode=2&scpguard=0&scpfull=0&scpver=0
unknown
text
295 b
whitelisted
5804
msedge.exe
GET
200
150.171.27.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:WC3r6bArCa4apNZD-5sT251dWFkqKXBenGHryJ0jPTg&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
5804
msedge.exe
GET
200
104.18.22.222:443
https://copilot.microsoft.com/c/api/user/eligibility
unknown
text
25 b
whitelisted
5804
msedge.exe
GET
200
13.107.213.44:443
https://api.edgeoffer.microsoft.com/edgeoffer/pb/experiments?appId=edge-extensions&country=US
unknown
binary
82 b
whitelisted
5804
msedge.exe
GET
200
141.147.2.8:443
https://verify-meta-check.t3.storage.dev/Verify-me-to-continue-ID-J-26016.html
unknown
text
128 Kb
unknown
5804
msedge.exe
GET
404
141.147.2.8:443
https://verify-meta-check.t3.storage.dev/favicon.ico
unknown
xml
267 b
unknown
5804
msedge.exe
GET
200
2.16.204.141:443
https://www.bing.com/bloomfilterfiles/ExpandedDomainsFilterGlobal.json
unknown
text
128 Kb
whitelisted
5804
msedge.exe
GET
200
13.107.246.44:443
https://xpaywalletcdn.azureedge.net/mswallet/ExpressCheckout/v1/GetGlobalConfig?EdgeChannel=stable&EdgeVersion=133.0.3065.92&ConfigVersion=0
unknown
text
128 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
7448
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
936
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
5804
msedge.exe
150.171.22.17:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5804
msedge.exe
150.171.27.11:80
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5804
msedge.exe
150.171.27.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5804
msedge.exe
141.147.2.8:443
verify-meta-check.t3.storage.dev
ORACLE-BMC-31898
US
unknown
5804
msedge.exe
13.107.213.44:443
api.edgeoffer.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.251.141.110
whitelisted
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted
config.edge.skype.com
  • 150.171.22.17
whitelisted
verify-meta-check.t3.storage.dev
  • 141.147.2.8
  • 130.61.151.221
unknown
api.edgeoffer.microsoft.com
  • 13.107.213.44
  • 13.107.246.44
whitelisted
copilot.microsoft.com
  • 104.18.22.222
  • 104.18.23.222
whitelisted
www.bing.com
  • 2.16.204.141
  • 2.16.204.161
whitelisted
xpaywalletcdn.azureedge.net
  • 13.107.246.44
  • 13.107.213.44
whitelisted
update.googleapis.com
  • 216.58.206.35
whitelisted
clients2.googleusercontent.com
  • 172.217.18.1
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M1
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
3224
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
9120
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://verify-meta-check.t3.storage.dev/Verify-me-to-continue-ID-J-26016.html